When you say it frequently enough, you'll appreciate the one less syllable over "zero."

edit: I even think it's more natural. "Zero day" are two real words that could be a sentence fragment, "oh-day" feels like a new word. Saying "that's a zero day" feels like an incorrect sentence to me (uncanny valley), whereas "that's an oh-day" only sounds weird if you don't accept "oh-day" as a word. To me, "oh-day" is similar to most slang, where it feels natural to say/hear even when you don't know what it means.

As far as I'm aware, the rule is if the first syllable starts with a vowel, phonetically.

In your example "MVP", the first syllable starts with an "em", so a vowel. In "Minimal Viable Product" the first syllable starts with the consonant sound.

I had a major pain with this rule when dealing with auto-generation of some API documentation. It ended up just being an issue of detecting/guessing if the text was an abbreviation or some weird CamelCase thing.

That's because "an MVP" is "an em-pee-vee". It sounds natural because the "an" is preceding a vowel sound. That does not happen in "an 0-day".

I asked my infosec friend today, and he said that “zero day” and “oh day” are interchangeable pronunciations.

Which would more correctly be "a naught-day" anyway. "Aught" and "ought" are abbreviated, rebracketed forms of "naught" and "nought", respectively. But etymologically, their strict meanings may be interpreted as anything or everything. They are thus in the rare category of auto-antonyms or contronyms.

As such, I would only use them to give elven advice (that is, intentionally ambiguous advice). In the context of software vulnerabilities, an aught-day would either be a 0-day, or one with an indeterminate nonzero number of days lead time to patch. So, maybe something the vendor knows about, but it would take rare expertise crossed with obscure motive to exploit?

You should listen to people read phone numbers.

"One oh four, zero one eighty"

or "ought", maybe?